[{"titre":"i-Dressup and a data security mess-up","id":3203250,"pubDate":"Thu, 08 Oct 2026 08:06:59 +0200","description":"i-Dressup and a data security mess-up lfair April 24, 2019 | 3:08PM i-Dressup and a data security mess-up By Lesley Fair Kids love to play dress-up, but parents wouldn’t want them rummaging through the attic or climbing to the top shelf of the wardrobe without permission and proper supervision. The i-Dressup.com website offered users – including children – a virtual way to play dress-up and design clothes without those potential dangers. But according to an FTC complaint, Unixiz, Inc. , the company behind i-Dressup, violated the Children’s Online Privacy Protection Act in ways that created different kinds of risks. COPPA puts two separate sets of protections in place to help keep parents in control of personal information collected from their kids online. First, COPPA-covered companies must clearly disclose their information policies and get parental consent before collecting personal information from children under 13. Second, companies must provide reasonable and appropriate security for the data they collect. According to an FTC settlement, i-Dressup fell short on both COPPA requirements. The complaint alleges i-Dressup failed to provide sufficient notice on its site of the information it collected online from kids, how it used it, its disclosure practices, and other specifics required by the COPPA Rule. The company’s direct notices to parents were deficient, too. Among other things, they didn’t include the COPPA-required statement that if parents don’t provide consent within a reasonable time, i-Dressup will delete their online contact information from its records. Stick with the story because that failure turned out to be particularly troubling. In addition to letting users play online games, i-Dressup featured a community where they could “explore their creativity and fashion sense with unique personal profiles” and interact with others. To register, i-Dressup required people to submit a user name, password, birthdate, and email address. If the birthdate indicated the person was under 13, the email field changed to “Parent’s Email.” Once the under-13 user filled in the required fields and clicked “Join Now,” i-Dressup collected the personal information and sent a message to the address entered into the Parent’s Email field. The person receiving the email could consent by clicking the “Activate Now!” button. However, if the parent didn’t give consent, i-Dressup retained the personal information it had collected from the child online. The FTC says the company’s failure to delete that information violated Section 312.5(c)(1) of the COPPA Rule. In addition to violating COPPA’s parental consent provisions, i-Dressup allegedly violated the Rule’s data security requirements . According to the FTC, i-Dressup stored and transmitted users’ personal information (including passwords) in plain text. In addition, the company failed to perform network vulnerability testing of its network, even for well-known threats like SQL attacks; it didn’t implement an intrusion detection and prevention system; and it didn’t monitor for potential security incidents. The upshot? The company learned that a hacker had gained entry to its network and accessed information about 2.1 million users, including approximately 245,000 users who indicated they were under 13. To settle the case , i-Dressup and its owners will pay a $35,000 civil penalty. They’re also prohibited from violating COPPA in the future, and can’t sell, share, or collect any personal information until they implement a comprehensive data security program and get independent biennial assessments. In addition, they’ll have to provide the FTC with an annual certification of compliance. The message for sites and operators covered by COPPA is that an effective system of parental consent is only the first step toward compliance. Section 312.8 of the COPPA Rule also requires you to “establish and maintain reasonable","source":"FTC USA Business Blog Posts","url":"https://www.ftc.gov/business-guidance/blog/2019/04/i-dressup-data-security-mess"},{"url":"https://www.ftc.gov/business-guidance/blog/2019/06/two-aisle-ftcs-thats-ticket-workshop","source":"FTC USA Business Blog Posts","description":"Two on the aisle for FTC’s “That’s the Ticket” workshop lfair June 6, 2019 | 10:40AM Two on the aisle for FTC’s “That’s the Ticket” workshop By Lesley Fair Humphrey Bogart said it in “The African Queen” and it was a catchphrase popularized by Jon Lovitz on “Saturday Night Live.” But to the FTC, That’s the Ticket is the name of a June 11, 2019, workshop to explore consumer protection issues related to online ticket sales – and the agenda is out now. Consumers who try to buy tickets online to a concert, theatrical performance, or sporting event have often expressed frustration with the process. That’s the Ticket will bring together advocates, industry members, academics, and law enforcers to explore the topic from the consumer’s perspective. FTC Commissioner Slaughter will open the event at 9:30 ET. Next on the agenda: Professor Eric Budish from the University of Chicago’s Booth School of Business, who will share his insights into the issues. The first panel will explore Bots and the BOTS Act . Passed in 2016, the Better Online Ticket Sales Act makes it illegal to “circumvent a security measure, access control system, or other technological control or measure on an Internet website or online service that is used by the ticket issuer to enforce posted event ticket purchasing limits or to maintain the integrity of posted online ticket purchasing order rules.” The next panel will address Other Consumer Protection Issues Around Ticket Availability . After a mid-day break, the topic will turn to The Adequacy of Ticket Price and Fee Disclosures . Do consumers have accurate information about how much they’ll be charged? The last panel of the afternoon will consider Consumer Confusion: What and From Whom Am I Buying? Do buyers have a clear picture of what they’re getting and the identity of the seller? Mary Engle, Director of the FTC’s Division of Advertising Practices, will offer closing remarks. Ironically enough, you don’t need a ticket to attend That’s the Ticket , which will take place on June 11th at the FTC’s Constitution Center conference facility, 400 7th Street, S.W., in Washington, DC. The event is free and open to the public or you can watch via webcast, which will go live moments before the 9:30 ET starting time on the That’s the Ticket event page. We’ll also live tweet using the hashtag #FTCticket.    ","pubDate":"Mon, 05 Oct 2026 14:07:45 +0200","id":3198174,"titre":"Two on the aisle for FTC’s “That’s the Ticket” workshop"}]